One thing I observe every day in my job is password complexity or non-complexity. It amazes me how predictable passwords people use can be. So, I have come up with a few rules to use when creating passwords. I have been on a “Karate Kid” movie kick here lately so I am using rules this week.
Rule 1 – Don’t use common factors everyone know about you. That would be kids, pets and family names. Do not use your address or phone number – people know them or can find them easily on the internet. Don’t use your favorite places or places you vacation. Anyone with a Facebook account can figure this out from your posts.
Rule 2 – A good password is one no one can remember, even yourself. If you find yourself going, “Darn, what is my password,” a lot, then you have probably picked a good one. Get an application on your phone like 1password or ipasssafe to remember your passwords. Just remember to put a password on your phone and make the one to get into the app really good.
Rule 3 – Just when you start to get the hang of your new password change it. You should change your passwords every 90 days if not sooner. Try not to repeat passwords or create patterns this is very predictable by password cracking tools and hackers. Get creative and be sure to use numbers, capital letters and null characters (%^&*). No, I am not cursing at you I am just letting you know what a null character is. Take a password like strawberry. You can secure it up a little by using Str@wb3rrY. It is not 100% secure but you are going to make them work hard to decrypt it and chances are before they decrypt it they will move on to an easier victim.
Rule 4 – Don’t use the same password for everything. I recommend only use a password for one site or program. Then make another for each different program you use. This is how fast it can spiral downward: Someone hacks your Twitter or Facebook account. Then they login to the pay portal you pay for all your fun games with. There are programs out there that tell hackers what company a card number belongs to. They then login into your credit card account and get your address and the bank account info you use to pay your credit card. They then gain access to your bank account. Just that easy, they have access to all your personal accounts. If you use different passwords for each account then they are stopped after they hack the first one. You can easily fix the Facebook one, it’s the others that will cost you a lot of heartache and grief.
Rule 5 – The final rule and most important. Don’t write down your passwords. I can’t tell you how many desks I used to go to and see passwords posted in plain sight. The worst is most of them were labeled what program they were for. My users have learned that I will throw these away and now hide them if they do write them down. Even this is a bad idea. If you are going to write them down use some sort of anagram so no one can figure it out. Then hide it in a locked drawer or store it somewhere where only you can get to it.